Fintech

The Reserve Bank of India (RBI) recently shortened the timelines within which credit information needs to be reported and updated by credit institutions and Credit Information Companies (CICs), respectively through a notification on 8 August 2024 (Notification). Noting the pace at which short term credit is growing and digital credit underwriting is being undertaken, the RBI highlighted that Credit Information Reports (CIRs) must reflect information that is as close as possible to the current date.

The Digital Personal Data Protection Act 2023 (Act) places the primary obligation on ‘data fiduciaries’ to protect digital personal data of individuals and implement consent artifacts, including for any outsourcing arrangements for processing. Entities who merely process such data at the behest of another entity, called ‘data processors’ have been excluded from the statutory compliance obligations under the Act. The Act defines ‘data fiduciary’ as any entity determining the means and purpose of processing personal data.